Privacy policy

Contact

This app is operated by an individual under the public brand Catwa, not represented as an incorporated company. For support or privacy requests, contact owner@catwastore.com. Country: Egypt.

Information we process

The app processes your Shopify shop domain and ID, API access permissions and authentication tokens, and the staff identifier and access/session properties required for authentication. Staff names and email addresses are excluded from newly stored sessions and removed when older sessions are loaded. It reads product and variant identifiers, variant option names and values, collection identifiers, and discount settings. Customer and segment identifiers selected for eligibility are stored in discount configuration in Shopify. Shopify Functions evaluate cart items and customer identity within Shopify checkout.

Cloudflare D1 stores app sessions, temporary creation locks, synchronization progress, and minimal privacy-request receipts (customer ID, request ID, type, dates, processing status and customer-specific export references). Errors and operational logs may include shop and resource identifiers. The app does not collect payment card details.

How information is used

We use this information to authenticate access, synchronize app-owned variant option metadata, create and manage discount codes, evaluate matching rules, verify subscription access and limits, resolve errors, and respond to support and privacy requests.

Service providers

Shopify provides store APIs, checkout, customer records and discount storage. Cloudflare provides application hosting and D1 storage. Processing can involve countries outside your own. See Shopify’s privacy policy and Cloudflare’s privacy policy. No advertising tracking or sale of customer data is part of this app’s implementation.

Retention and deletion

Shop-scoped sessions, creation locks and synchronization jobs are removed when the app processes a verified uninstall or shop deletion webhook. Shopify-hosted discount configurations and app-owned metafields are separate from D1 and follow Shopify’s lifecycle and merchant controls. Pending privacy-request receipts survive uninstall so that requests are not silently lost; they are removed on shop/redact. Completed privacy-request receipts and prepared exports are purged from active D1 storage seven days after redaction completion or acknowledged export delivery. Undelivered exports and pending requests remain available for fulfillment. Cloudflare’s documented Workers Free log retention is three days where logging is enabled, and D1 Time Travel can retain earlier database states for seven days. Restoring a backup requires reapplying completed deletion requests before using restored data. Additional manual backups must be tracked and removed separately.

Optional draft recovery in your browser uses session storage. Drafts older than two hours are not restored. This does not guarantee physical removal from a closed browser at exactly two hours.

Requests and rights

Contact owner@catwastore.com for access, correction or deletion requests. We need to verify authorization and identify the relevant shop before disclosing information. Do not send passwords, access tokens or payment information. Shopify’s mandatory customer data request and deletion processes also apply. The authenticated Privacy requests screen prepares a customer-specific export or removes that customer’s references from existing app-owned discount metadata. Export preparation does not deliver the file: the authorized operator must give it securely to the verified store owner and acknowledge delivery. Shopify’s required fulfillment deadline is 30 days. Requests remain pending on failure and can be retried. If the app is uninstalled and Shopify access is unavailable, contact support to coordinate any remaining Shopify-hosted data.

Security

Production traffic uses HTTPS. Administrative features require authenticated Shopify sessions. Webhook signatures are verified before handling, and shop-scoped database values use bound statements. No security certification or guarantee of absolute security is claimed.

Changes

Material changes will be reflected on this page with an updated date. This policy does not replace mandatory business identity disclosures or applicable legal obligations.